glm-5.3-flash
9587670138
- docs/architecture/: README index, overview, wire, producer, consumer, vendor, bast specs + open-questions.md (the OQ-SK-01..09 ledger promoted; new questions as OQ-SK2-06..) - ADRs 001-012: ALPN/op/params, protocol base, the handle swap, the dial-callback shape, auth split by the door, access control (open gate + BIND command gate), BIND in base, provider defaults, feature gates, channel capacity, the inline vendor, target policy - deferred OQs (SK2-06, SK2-07) with tracker tasks in tasks/architecture/ per the sdd_process deferred-OQ protocol - review pass applied: frame-length joint bound (65766 corner), accept_no_auth vs skip_auth corrected against fast-socks5 source, composed-feature wasm posture, cross-reference fixes Verified: cross-references (all ADR/OQ refs resolve), doc sizes under split threshold, Phase 0 fidelity spot-checks
53 lines
1.5 KiB
Markdown
53 lines
1.5 KiB
Markdown
---
|
|
id: architecture/oq-sk2-07-virtual-subnet-helper
|
|
name: Track — OQ-SK2-07 unblock condition (virtual-subnet deployment)
|
|
status: pending
|
|
depends_on: []
|
|
scope: single
|
|
risk: trivial
|
|
impact: component
|
|
level: research
|
|
---
|
|
|
|
## Description
|
|
|
|
External-trigger tracker for OQ-SK2-07 (`docs/architecture/
|
|
open-questions.md`): the virtual-subnet translation-layer helper.
|
|
This task is NOT actionable work — it tracks whether the external
|
|
unblocking condition has arrived. Tagged `[external-trigger,
|
|
deferred-oq]` per `docs/sdd_process.md` §Deferred OQs.
|
|
|
|
**Unblocking condition**: a concrete deployment wants identity-scoped
|
|
virtual subnets (proxied resources IP-addressable per identity) —
|
|
the shape ADR-012 resolved as assembly-layer policy over the dial
|
|
callback.
|
|
|
|
## Work
|
|
|
|
When the condition arrives:
|
|
|
|
1. Mark this task `completed` (the condition arrived).
|
|
2. Transition OQ-SK2-07 from `deferred(scope)` to `open` (or
|
|
directly to `resolved` if assembly-layer policy still suffices).
|
|
3. Decide: does a translation-table helper graduate into the crate
|
|
(subnet sizing, per-identity tables, hub exposure)? Check
|
|
tun2proxy's virtual-network/virtual-DNS support as prior art
|
|
(`/workspace/tun2proxy`).
|
|
|
|
## Verification
|
|
|
|
N/A (tracking task — trivial risk, no code).
|
|
|
|
## Out of scope
|
|
|
|
Any crate-level implementation of the translation layer before the
|
|
condition arrives (ADR-012: the dial callback is the seam; the
|
|
crate's obligation is only that the seams support it).
|
|
|
|
## Notes
|
|
|
|
> Agent fills this during implementation.
|
|
|
|
## Summary
|
|
|
|
> Agent fills this on completion. |